@zerotoallai/core

Domain-agnostic scoring engine for permissionless trust baselines.

Overview

This is the core scoring engine of the zerotoall protocol. It provides:

• Quadratic Weighting: Anti-manipulation mechanism that reduces influence of repeat submissions
• Aggregation: Baseline calculation across multiple dimensions
• Trust Evolution: Drift detection and timeline tracking
• Schemas: Domain-agnostic evaluation types

Installation

npm install @zerotoallai/core

Usage

Quadratic Weighting

import { calculateQuadraticWeight, aggregateScoresQuadratic } from '@zerotoallai/core';

// Single weight calculation
const weight = calculateQuadraticWeight(4);  // 0.5 (4 submissions = 50% influence)

// Aggregate scores from multiple evaluators
const result = aggregateScoresQuadratic([
  { submissionCount: 1, score: 80 },
  { submissionCount: 10, score: 60 },
  { submissionCount: 2, score: 70 },
]);

console.log(result);
// {
//   aggregatedScore: 75,
//   totalEvaluators: 3,
//   effectiveSampleSize: 2.0,
//   confidence: 'low'
// }

Baseline Aggregation

import { aggregateToBaseline, compareWithBaseline } from '@zerotoallai/core';

// Aggregate evaluations into baseline
const baseline = aggregateToBaseline([
  { evaluatorId: 'a', submissionCount: 1, scores: { security: 80, reliability: 90 } },
  { evaluatorId: 'b', submissionCount: 3, scores: { security: 70, reliability: 85 } },
]);

// Compare subject against baseline
const comparison = compareWithBaseline(
  { security: 85, reliability: 75 },
  baseline
);

console.log(comparison);
// {
//   comparisons: {
//     security: { subjectScore: 85, baselineAverage: 77, gap: 8, position: 'above' },
//     reliability: { subjectScore: 75, baselineAverage: 88, gap: -13, position: 'below' }
//   },
//   overallAlignment: 79
// }

MCP Server Analyzer

Analyze MCP server security posture from package.json:

import { analyzeMcpServer } from '@zerotoallai/core';

// Analyze an MCP server
const result = analyzeMcpServer({
  name: "@example/mcp-server",
  version: "1.0.0",
  description: "Example MCP server",
  author: "Example Author",
  license: "MIT",
  repository: "https://github.com/example/mcp-server",
  dependencies: {
    "axios": "^1.0.0",      // Detected: network access
    "fs-extra": "^10.0.0",  // Detected: file write
  },
});

console.log(result);
// {
//   name: "@example/mcp-server",
//   riskLevel: "medium",
//   overallScore: 68,
//   permissions: {
//     fileRead: true,
//     fileWrite: true,
//     shellExecute: false,
//     networkFetch: true,
//     envAccess: false
//   },
//   risks: [
//     { pattern: "undeclared_permissions", severity: "medium", ... }
//   ],
//   positives: ["Licensed: MIT", "Source code available", "No shell access"],
//   confidence: "medium"
// }

Risk Levels

| Level | Score | Meaning | |-------|-------|---------| | low | 80+ | Safe, minimal permissions | | medium | 60-79 | Some permissions detected | | high | 40-59 | Multiple risk patterns | | critical | <40 | Dangerous permission combinations |

Critical Risk Patterns

• file_write_shell: File write + shell = arbitrary code execution
• network_env: Network + env access = secret exfiltration risk
• suspicious_deps: Git URLs, wildcard versions, non-registry sources

Trust Evolution

import { createSnapshot, buildTimeline, detectSignificantDrifts } from '@zerotoallai/core';

// Create snapshots over time
const snapshot1 = createSnapshot('server-a', 75, { security: 80 }, 'medium', 5);
const snapshot2 = createSnapshot('server-a', 45, { security: 40 }, 'high', 12);

// Build timeline
const timeline = buildTimeline('server-a', [snapshot1, snapshot2]);

console.log(timeline.trend);  // 'degrading'

// Detect significant drifts
const drifts = detectSignificantDrifts(timeline);
// Returns drift alerts for significant changes

Exports

// Scoring
export { calculateQuadraticWeight, aggregateScoresQuadratic } from '@zerotoallai/core';

// Aggregation
export { aggregateToBaseline, compareWithBaseline } from '@zerotoallai/core';

// Trust Evolution
export { createSnapshot, buildTimeline, detectSignificantDrifts } from '@zerotoallai/core';

// MCP Analyzer
export { analyzeMcpServer, type McpServerPosture, type PackageJson } from '@zerotoallai/core';

// Version
export { PROTOCOL_VERSION } from '@zerotoallai/core';

Philosophy

This module implements concepts from:

• Plurality (Audrey Tang, Glen Weyl) - Quadratic weighting for plural voices
• Balance of Power (Vitalik Buterin) - Protocol as field designer, not referee
• X Community Notes - Bridging-based consensus

License

MIT